-
The Polymarket breach temporarily interrupted trading on October 29 after attackers used a compromised third-party service to distribute cryptocurrency-draining JavaScript. Investigators traced approximately $2.5 million in assets through a suspected attacker wallet, although Polymarket has not confirmed its total losses. The incident affected the company’s international platform, Polymarket.com. Polymarket said it fixed the issue, contacted…
-
A fake crypto app that appeared on Apple’s App Store has been linked to a wallet-draining operation involving approximately $23,000. Blockchain investigator Iris identified 27 affected Solana wallets, although only one victim’s loss has a confirmed connection to the malicious app. The app, called Padre Terminal, impersonated a legitimate cryptocurrency trading service. According to Iris,…
-
Hackers are exploiting a Cisco SD-WAN flaw to deploy KeyDrift, a custom malware framework designed to maintain access and steal sensitive cryptographic material. Cisco Talos identified the attackers as UAT-11473 and observed attacks against space, satellite, defence, aerospace and policy research organisations. The group targets CVE-2026-20127, a maximum-severity authentication bypass vulnerability that Cisco patched in…
-
The Virtualine seizure has disrupted a bulletproof hosting service that authorities link to ransomware, phishing and other criminal activity. US investigators took control of its primary domain, while Dutch police seized physical servers and recovered information on more than 3,000 customers. The service operated under several names, including Secury, Massgod, Spamhouse, Lanedo and Omegatech. According…
-
Discord search indexing will make eligible messages from Discoverable Servers accessible through web searches without an account or invitation. The company plans to introduce public server pages on November 16, followed by a gradual message-sharing rollout from mid-December. The change aims to bring useful community discussions to people outside Discord. However, it applies only to…
-
The Sony ISP breach has exposed more than 2.5 million records containing personal information belonging to current and former customers in Japan. Sony Network Communications confirmed that an unauthorised party accessed its So-net member database on October 19. The company detected the intrusion on October 23, four days after the breach occurred. It then shut…
-
Volt Typhoon is using a framework called Silent Train to conceal targeted attacks behind rotating chains of compromised devices. Black Lotus Labs detailed the activity on October 28 after tracking the Chinese state-sponsored hacking group’s infrastructure for three years. Researchers linked the framework to zero-day exploitation against enterprise networking and management platforms. Its targets span…
-
Attackers are exploiting network infrastructure flaws across enterprise gateways, management platforms and email security appliances, according to Eclypsium’s October InfraTrust Pulse report. Meanwhile, recently disclosed PHP2Shell vulnerabilities create additional risks for devices that use PHP-based administration interfaces. The report tracked 133 new security advisories across 18 vendors between September 18 and October 14, covering 2,813…
-
Attackers are scanning the internet for systems vulnerable to a critical Oracle EBS flaw that Oracle patched on October 20. Threat intelligence researchers detected the activity on October 27, just one week after the security update became available. Tracked as CVE-2026-101767, the vulnerability affects the Application Object Library in Oracle E-Business Suite. It allows unauthenticated…
-
The Node2Shell vulnerability is under active exploitation, the US Cybersecurity and Infrastructure Security Agency confirmed on October 27. CISA added the critical Brotli flaw to its Known Exploited Vulnerabilities catalogue and set a November 10 patching deadline for federal agencies. Tracked as CVE-2026-111497, the issue affects software that uses vulnerable implementations of Google’s Brotli compression…